T08 · Insecure Dependencies
Note
- Location
runtime/hkipo-next/pyproject.toml:10- Finding
Unpinned Runtime Dependencies Permit Unreviewed Supply-Chain Changes
- Content
View full analysis
=4.14.3", "httpx>=0.28.1", "lxml>=6.0.4", "opencc-python-reimplemented>=0.1.7", "pydantic>=2.13.0", "requests>=2.33.1", ] ``` `SKILL.md:17` and `SKILL.md:32`: ```bash uv run --directory runtime/hkipo-next hkipo-next ... ``` ```bash uv run --directory runtime/hkipo-next hkipo-next calendar --window deadline --days 7 --format json ``` ### Technical Analysis The runtime dependencies specify only lower version bounds using `>=`. The audited project does not include a dependency lockfile, integrity hashes, or upper version constraints. The documented `uv run` workflow may consequently resolve and install package versions that were released after the Skill itself was reviewed. This creates a supply-chain trust gap: the effective code executed by the Skill can change without any corresponding modification to the audited project. Although no dependency is confirmed to be malicious, a compromised maintainer account, malicious package release, or compromised package-distribution infrastructure could introduce attacker-controlled code into a future dependency version. This issue is classified as `T08: Insecure Dependencies`. It is not evidence that the current dependencies are malicious; the risk arises from non-reproducible resolution of future, unreviewed versions. ### Attack Path 1. An attacker compromises the publishing account or release process of one of the allowed dependencies, or compromises its downstream dependency chain. 2. The attacker publishes a version newer than the minimum version accepted by the relevant `>=` constraint. 3. A user invokes the documented `uv run --direc ...[truncated 1732 chars]- Remediation
View remediation
=` constraints. 4. Use package hash verification where supported to ensure downloaded artifacts match approved distributions. 5. Resolve and install dependencies during a controlled build or deployment stage rather than during normal Skill execution. 6. Review both direct and transitive dependency updates before regenerating the lockfile. 7. Add automated dependency scanning and provenance checks to the release process. 8. Run the Skill in a restricted environment with minimal filesystem access, limited environment variables, and outbound network access limited to required IPO-data hosts. ]]>